Autonomous identity cross-domain authentication method, storage medium and electronic equipment

Abstract

The invention relates to the technical field of identity authentication, in particular to an autonomous identity cross-domain authentication method, a storage medium and electronic equipment. The key is to solve the problem of key explosion of a traditional multi-attribute authentication system through a single trap door-multi-attribute public key structure. A user locally generates a main public key matrix A and a short-base trap door TA, and calculates a DID based on A and an identity label; and receiving an attribute random matrix Qj returned by the voucher issuing mechanism, splicing to form an attribute public key matrix APKj = [A | Qj], and sharing TA by all APKj to realize the multi-authentication domain independent anti-quantum signature. According to the design, the private key storage overhead is reduced from O (n) to O (1), flexible combination and minimum disclosure of cross-domain heterogeneous attributes are supported, privacy protection is enhanced through a unified trap door mechanism, and the expandability and practicability of the system are improved.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and in particular to a method, storage medium, and electronic device for cross-domain authentication of self-identity. Background Technology

[0002] With the development of decentralized identity (DID) and self-sovereign identity (SSI) concepts, users expect to control their digital identities independently without relying on centralized identity providers, and to disclose the minimum necessary attributes as needed to complete authentication in different service domains (such as government affairs, finance, healthcare, and industrial internet). Therefore, attribute-based authentication mechanisms based on cryptographic credentials have become a research hotspot.

[0003] However, existing solutions still face multiple challenges:

[0004] First, in terms of key management, traditional multi-attribute authentication systems typically assign independent public-private key pairs to each attribute or combination of attributes. When a user has dozens or even hundreds of attributes, the number of keys explodes, leading not only to huge storage and computing overhead but also significantly increasing the complexity of key synchronization, updating, and revocation, making it difficult to meet the application needs of resource-constrained devices (such as IoT terminals).

[0005] Secondly, regarding the flexibility of cross-domain attribute combination, most schemes require attribute credentials to be issued by the same issuing authority or rely on complex policy negotiation mechanisms, making it difficult for users to flexibly combine attributes from different sources across heterogeneous authentication domains (for example, combining the "educational background" attribute with the "professional qualification" attribute for use on a professional service platform), thus limiting the actual usability of self-identity.

[0006] Secondly, regarding security, current mainstream solutions are generally based on classic public-key cryptosystems such as RSA and ECC, whose security relies on number theory problems such as large integer factorization or discrete logarithms. However, with the rapid development of quantum computing technology, Shor's algorithm can break such cryptosystems in polynomial time, posing a serious "harvest now, decrypt later" attack risk to existing identity infrastructure, necessitating a migration to a post-quantum-secure architecture.

[0007] Finally, regarding privacy protection, even if anonymous credential technology (such as group signatures and ring signatures) is used, if the underlying cryptographic primitives do not have quantum resistance or the key structure is poorly designed, user behavior may still be tracked and linked, making it impossible to truly achieve the privacy goals of "minimum disclosure" and "unlinkability".

[0008] Although lattice-based cryptography is considered a candidate for the next generation of cryptographic infrastructure due to its quantum-resistant security and rich functional characteristics (such as trapdoor mechanisms and homomorphic properties), how to efficiently integrate it into autonomous identity systems, especially while ensuring quantum-resistant security, remains a technical bottleneck that has not yet been fully resolved in multi-attribute scenarios and solving the problems of key expansion and cross-domain combination.

[0009] Therefore, there is an urgent need for a new type of autonomous identity cross-domain authentication method that, under the premise of quantum security, can significantly reduce the key management burden on the user end through innovative key structure design, support flexible multi-attribute cross-domain combinations, and provide a solid cryptographic foundation for subsequent anonymous authentication. Summary of the Invention

[0010] To address one of the aforementioned technical problems, the present invention adopts the following technical solution:

[0011] According to one aspect of the present invention, a method for cross-domain authentication of autonomous identity is provided, comprising:

[0012] The user locally executes a trapdoor generation algorithm to generate the master public key matrix A and the corresponding short-base trapdoor T. A ;

[0013] Based on the master public key matrix A and the user identity ID π Calculate the decentralized identity identifier (DID);

[0014] Submit attribute verification materials to the certificate issuing authority and receive a random matrix returned by the certificate issuing authority for each attribute;

[0015] The master public key matrix A is concatenated with each random matrix to form multiple attribute public key matrices; wherein, the j-th attribute public key matrix APK j =[A∣Q j ], Q j Let be the j-th random matrix, j = 1, 2, 3…n, where n is the total number of random matrices returned by the credential issuing authority; | is the concatenation function; all attribute public key matrices share the same trapdoor T. A This allows users to perform independent quantum-resistant signature operations on different attribute combinations in multiple authentication domains by maintaining only a single trapdoor, providing a cryptographic credential basis for cross-domain anonymous authentication.

[0016] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the aforementioned autonomous identity cross-domain authentication method.

[0017] According to a third aspect of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned autonomous identity cross-domain authentication method.

[0018] This invention has at least one of the following beneficial effects:

[0019] This invention effectively solves the key explosion problem caused by the linear increase in the number of keys with the number of attributes in traditional multi-attribute authentication systems by introducing a "single trapdoor-multi-attribute public key" structure. Specifically, users only need to execute the trapdoor generation algorithm TrapGen once locally to obtain a master public key matrix A and its corresponding short-basis trapdoor T. A Subsequently, regardless of how many attributes the credential issuing authority (CI) issues to the user, each attribute corresponds to only one matrix Q randomly generated by the CI. j Users only need to enter A and Q j By concatenating these elements, an attribute public key matrix (APK) can be formed. j =[A∣Q j This eliminates the need to regenerate or store separate private keys for each attribute. Because all APKs... j Shared trapdoor T A Users can reuse this trapdoor to perform quantum-resistant signature operations on public keys with arbitrary attributes during subsequent signatures. This design reduces the original O(n) private key storage and management overhead to O(1), greatly alleviating the computational and storage burden on users (especially resource-constrained IoT devices), while simplifying the key lifecycle management process and significantly improving the scalability and usability of the system.

[0020] Meanwhile, the attribute public key matrix APK constructed in this invention j =[A∣Q j It features modularity and decoupling, allowing attributes from different sources to be flexibly combined and used across multiple authentication domains. Because each Q... j The credentials are independently generated and bound to specific attribute semantics by the relevant domain's issuing authority, while the master public key A serves as the unified anchor for user identity across all attributes. Therefore, users can freely choose any subset of APKs. jParticipate in the authentication process. For example, when accessing an industrial service platform, a user can simultaneously present a public key with an "academic qualification" attribute issued by an educational institution and a public key with a "certification" attribute issued by an industry association. Although these two keys come from different issuers, they share the same master public key A and trapdoor T. A It can be uniformly incorporated into subsequent ring signature or zero-knowledge proof protocols for joint verification. It breaks the limitation of traditional schemes that attributes must be of the same origin or rely on centralized strategies for coordination, realizes the autonomous combination of cross-domain and heterogeneous attributes with minimal disclosure, and enhances the interoperability and user control of autonomous identity systems.

[0021] Furthermore, this invention, through a unified trapdoor mechanism, lays a crucial key foundation for achieving advanced privacy protection functions (such as anonymous credentials and linkable ring signatures). Because all attributes of the public key APK... j Shared trapdoor T A When performing anonymous signing, users can exploit this trap to target any selected APK. j This invention generates statistically indistinguishable short vector responses, thereby hiding the user's identity within a "ring" of multiple user public keys. In the traditional "one attribute, one key pair" model, the private key distributions corresponding to different attributes may be inconsistent, leading to signature statistical features revealing the true identity and compromising anonymity. The single trapdoor design of this invention ensures that all attribute signature operations originate from the same random source, preventing verifiers from associating identities through differences in signature distribution. Furthermore, this structure inherently supports the "least disclosure" principle, requiring users to expose only the APK related to the current service. j All other attributes are completely hidden. Therefore, this invention not only solves the key management problem, but also strengthens privacy protection capabilities at the key architecture level. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a self-identity cross-domain authentication method provided in an embodiment of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] As one possible embodiment of the present invention, such as Figure 1 As shown, a self-identifying cross-domain authentication method is provided, including:

[0026] S100: The user locally executes the trapdoor generation algorithm to generate the master public key matrix A and the corresponding short-basis trapdoor T. A .

[0027] This step requires inputting the public parameter pp and the user's ID to generate a personal master-private key using a local trapdoor base generation algorithm. Before this step, we need to obtain the public parameter pp, which is generated as follows:

[0028] Common parameters pp = (B, H, H1)

[0029] 1. Select parameters: safety parameter n, large integer modulus q≥3, positive integer m1 (satisfying m1>5mnlogq), positive integer m2; where n, m1 and m2 represent the number of rows and columns of the correlation matrix, respectively.

[0030] 2. Select two collision-resistant hash functions: ;

[0031] 3. Randomly select a matrix .

[0032] Specifically, the trapdoor generation algorithm is TrapGen(1 n Output the master public key matrix that satisfies the following conditions. and short base trap T A :

[0033] A is statistically close to a uniform distribution. Let A be a matrix consisting of n×m1 elements, where each element is an integer modulo q.

[0034] T A Let A be a short basis of A, used to generate samples that satisfy the presampling algorithm SamplePre. and private key sk π ,in .

[0035] Here, q is a large integer modulus. In most scenarios of lattice-based cryptography (such as RLWE), q is a prime number, and is therefore often referred to as a prime modulus. This is the key to achieving good operational properties of finite fields / rings. For private key sk π The upper bound of H1 is the first preset hash algorithm, and the output result is a vector.

[0036] User ID=ID π Taking the public parameter pp as an example, let's explain the public key pk. π Private key sk π Attribute public key apk π The generation process:

[0037] Call Generate an approximately random matrix. and short base trap gate T A ;

[0038] calculate ;

[0039] Call Calculate the private key ,satisfy and .

[0040] In this step, the user locally generates the master public key matrix A and its corresponding short base trapdoor T. A It is not arbitrarily constructed, but rather generated using the standard trapdoor generation algorithm TrapGen(1) in lattice cryptography. n The algorithm is rigorously generated. Its security is based on computationally difficult problems in lattice theory, typically represented by the Short Integer Solution (SIS) and Learning With Errors (LWE) problems. These two types of problems possess important cryptographic properties: even under quantum computing models, no known polynomial-time algorithm can currently solve them efficiently, thus they are widely regarded as a reliable cornerstone for building post-quantum secure cryptosystems.

[0041] In contrast, the security of current mainstream public-key cryptosystems (such as RSA and elliptic curve cryptography ECC) relies on integer factorization or discrete logarithm problems. However, Shor's algorithm has been theoretically proven to be able to solve these problems efficiently in polynomial time on quantum computers. This breakthrough means that attackers can implement a "store-now-decrypt" attack strategy: intercepting and storing encrypted identity credentials or communication data now, and then decrypting them in bulk when quantum computing capabilities mature in the future, thus posing a serious threat to existing digital identity infrastructure.

[0042] To address the aforementioned issues, this invention employs a quantum-resistant security mechanism from the key generation source. Specifically, the user's private key sk π It is not generated independently, but is based on the trapdoor T. A The presampling algorithm SamplePre is used to obtain the equation The private key vector sk is obtained through sampling. This process not only ensures the generated private key vector sk is... π The Euclidean norm satisfies (where σ is the Gaussian parameter), thus maintaining the security boundary of the lattice cryptography scheme; at the same time, its output distribution is carefully designed to approximate a discrete Gaussian distribution, possessing good randomness and unpredictability. This ensures both the correctness and efficiency of subsequent signature operations, while avoiding the risk of side-channel or statistical leakage due to abnormal private key structure.

[0043] S200: Based on the master public key matrix A and user identity ID π Calculate the decentralized identity identifier (DID).

[0044] Decentralized identity identifiers (DIDs) must meet the following conditions: .

[0045] Where H is the second preset hash function, and the output result is a numerical value.

[0046] The DID is calculated locally by the user, relying solely on the master public key A and its own identity identifier, without the need for any centralized institution to participate in its generation or distribution. Since A itself is generated locally by the user and cannot be forged, DID = H(A | ID). π It possesses global uniqueness and non-repudiation. This design empowers users to truly control their identity, allowing them to reconstruct their identity based on their local key even if the issuing authority or registration platform fails, significantly enhancing the system's decentralization and user autonomy.

[0047] S300: Submit attribute verification materials to the certificate issuing authority and receive the random matrix returned by the certificate issuing authority for each attribute.

[0048] Registration is completed by submitting attribute verification materials to the certificate issuing authority. Let's assume the attribute is j. After the certificate issuing authority approves the application, it will randomly generate a random matrix corresponding to that attribute. The data is then returned to the user. Following the steps outlined in S400, multiple corresponding attribute public key matrices can be generated.

[0049] Specifically, the attribute public key matrix APK j =[A∣Q j ] , where Q j The certificate is randomly generated by the certificate issuing authority after verifying that the user has the corresponding attributes and is securely transmitted to the user, without containing plaintext attribute values.

[0050] The issuing authority does not return plaintext attribute values. Instead, it generates a matrix whose content is semantically bound to the attributes but randomized. This matrix itself does not contain readable attribute information; it serves only as a cryptographic commitment to the existence of the attributes. Even if an attacker intercepts it, they cannot deduce the specific attribute content of the user. This "attribute → random matrix" mapping mechanism ensures attribute verifiability while effectively preventing the direct leakage of attribute values, laying a privacy foundation for subsequent minimal disclosure authentication.

[0051] S400: Concatenate the master public key matrix A with each random matrix to form multiple attribute public key matrices. Among them, the j-th attribute public key matrix APK j =[A∣Q j ], Q j Let be the j-th random matrix, where j = 1, 2, 3…n, and n is the total number of random matrices returned by the credential issuing authority. | is the concatenation function. All attribute public key matrices share the same trapdoor T. A This allows users to perform independent quantum-resistant signature operations on different attribute combinations in multiple authentication domains by maintaining only a single trapdoor, providing a cryptographic credential basis for cross-domain anonymous authentication.

[0052] Because all attribute public keys in APK reuse the same master public key A and trapdoor T. A Users do not need to maintain an independent private key for each attribute, and the private key storage overhead is constant at O(1), completely avoiding the "key explosion" problem caused by the one-to-one correspondence between private keys and attributes in traditional schemes, which leads to a linear increase in the number of keys with each attribute. Furthermore, the attribute public key matrix corresponding to different attributes can come from different issuing authorities, allowing users to freely choose any subset of APKs for authentication, achieving on-demand combination of cross-domain and heterogeneous attributes. For example, the public key for the "academic qualification" attribute issued by an educational institution and the public key for the "qualification" attribute issued by an industry association can be combined for authentication on a professional service platform, greatly improving the practicality and interoperability of self-identity.

[0053] As another possible embodiment of the present invention, in the cross-domain authentication process, the user is based on the trapdoor T A A public key list consisting of any attribute public key matrix and the attribute public key matrices of other users within the current authentication domain. It executes a chainable ring signature algorithm based on the lattice cipher SIS hard problem to generate anonymous credentials containing chainable tags.

[0054] Here, "ring signature" refers to a user signing a document while hiding their identity within a set of public keys; "linkable" means that multiple signatures from the same user can be linked without revealing their identity; and "SIS-based" ensures quantum-resistant security.

[0055] Specifically, chainable ring signature algorithms include:

[0056] S501: Calculate Linkable Tags Where B is a preset matrix of linkable tags, .

[0057] Linkable tag b π It is a unique fingerprint used to identify "multiple actions by the same user". Here, sk... π B is the user's private key, and B is a fixed matrix (or session context-related matrix) in the public parameters. The private key and B are mixed and bound using a hash function H, which can further improve sk. π The encryption of sk will ultimately π It is bound to a public but irreversible tag. (Due to sk) π It is unique and confidential for each user, therefore b π It also has global uniqueness, but sk cannot be derived from it. π .

[0058] Because of b π User's private key sk π The only certainty is that anonymous credentials generated by the same user in different authentication sessions will contain the same b. π The verifying or auditing party can compare the data in historical documents with the data in section b. π It determines whether the operation is performed by the same entity, thus achieving "linkability". However, this tag does not participate in the verification logic of a single signature, and external observers cannot infer the user's identity based on a single credential. Therefore, while ensuring anonymity, it provides a post-event accountability mechanism for malicious behavior (such as repeated abuse of permissions).

[0059] S502: If the user's actual index in the public key list L is π, for each index i ≠ π, execute:

[0060] Short vectors are obtained through discrete Gaussian sampling. . i∈{1,…,N}, where N is the total number of attribute public key matrices in L. Given a discrete Gaussian distribution The sampling space is given by σ, and m1+m2 is the response vector z. π The dimension is the same as the number of columns in the attribute public key matrix. It is a notation for a vector space, representing the set of all integer vectors of dimension m1+m2, i.e., an (m1+m2)-dimensional integer lattice.

[0061] Calculate the intermediate value ID iLet be the user identifier corresponding to the i-th attribute public key matrix in L.

[0062] Calculate the next challenge value .

[0063] This is the process of "simulating a non-real signer" in ring signatures. For all members in the ring except themselves (i≠π), the user randomly generates a small norm vector z that meets the requirements of lattice cryptography. i And based on this, construct a seemingly valid intermediate value h. i And hash challenge c i+1 This series of operations forms a hash chain that starts with c1 and depends on each item in turn. The chain must eventually be "closed" by the real signer.

[0064] The responses of all non-real members z i All are generated through sampling from a discrete Gaussian distribution, and their statistical properties are ideally identical to the responses of the real signers. Since the verifier cannot distinguish which z... i It's impossible to pinpoint the real signer by identifying which signatures are genuine and which are simulated. This lattice-based simulation mechanism avoids the risk of identity leakage caused by key structure differences in traditional ring signatures, significantly improving the mathematical rigor and practical security of anonymity.

[0065] S503: For the actual index i=π, execute:

[0066] (a) Obtaining short vectors through discrete Gaussian sampling .

[0067] (b) Calculate the challenge value .

[0068] (c) Constructing the response vector (0) m2 ) T It is a 1×m2 row vector with all elements being 0. "∣" indicates horizontal concatenation, which means connecting the two vectors end to end.

[0069] The real signer uses the trapdoor T that they control. A and private key sk π Cleverly constructing response z π To make it satisfy the lattice equation Among them, the first m1 dimensions are composed of c π× sk π Contribution (corresponding to the master public key A part), followed by m2-dimensional zero padding (corresponding to the attribute extension part, such as Q). j Then, Gaussian noise e1 is superimposed to cover up traces of the private key.

[0070] If there is no trap door T AThe attacker cannot find a solution in polynomial time. The small norm solution x (i.e., the SIS problem is difficult). However, legitimate users can efficiently construct z using the SamplePre class method via a trapdoor. π This ensures that the signature process satisfies both algebraic constraints and maintains its small norm property. This makes the signature process computationally feasible while guaranteeing that only the true holder of the trapdoor can complete the closed loop, fundamentally preventing forgery.

[0071] S504: For the response vector z π Perform rejection sampling, retaining the result only if a preset probability condition is met, to ensure z π The statistical distribution of short vectors obtained by discrete Gaussian sampling is indistinguishable from that obtained by discrete Gaussian sampling.

[0072] If z π The distribution of z i (i≠π) Detectable differences exist, allowing attackers to perform statistical analysis on a large number of signature samples to identify the true signer. Rejection sampling forces the output distribution to approximate a standard discrete Gaussian distribution D by discarding a portion of the samples with a certain probability. σ This eliminates any potential statistical bias, making all response vectors statistically homogeneous and completely blocking identity inference paths based on distribution characteristics, thus further strengthening anonymity guarantees.

[0073] The contents of S501 to S504 above can be implemented with reference to the following algorithm:

[0074] Calculate linkable tags ;

[0075] when When π is the index of the real user, then execute:

[0076] Randomly generate one ,

[0077] calculate

[0078] implement

[0079] Randomly generate one

[0080] calculate

[0081] calculate

[0082] End for

[0083] calculate

[0084] Perform rejection sampling: with probability Keep the results, otherwise restart.

[0085] S505: Output anonymous credentials .

[0086] Anonymous credentials generated by the same user in different sessions have the same linkable tag to achieve cross-session linkability.

[0087] The voucher Ω explicitly includes the initial challenge c1 and the overall response. and linkable tag b π This provides a complete input for the verification algorithm. The structure is compatible with standard ring signature verification processes and inherently supports chainability extensions, facilitating reuse in different application scenarios (such as access control, audit logs, and behavioral analysis), thus improving the engineering practicality and interoperability of the solution.

[0088] S506: After obtaining anonymous credentials The verifier then verifies the anonymous credential Ω based on the public parameters and the public key list L. S506 includes:

[0089] Verify all z i Is the norm less than a preset threshold?

[0090] Verify the consistency of the hash chain and whether the closed-loop condition equation holds true.

[0091] If all the above conditions are verified, the user is deemed to have the corresponding attribute permissions.

[0092] In S506, the verifier checks in sequence:

[0093] (1) All z i Is it "shortest enough" (to prevent large vector forgery)?

[0094] (2) Hash Chain Whether it is self-consistent;

[0095] (3) Does it satisfy the global closed-loop equation? The closed-loop equation is valid only if at least one member can generate a valid response using a trapdoor.

[0096] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0097] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0098] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0099] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0100] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0101] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0102] The memory stores program code that can be executed by a processor, causing the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0103] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0104] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0105] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0106] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0107] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the present invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the present invention described in the "Exemplary Methods" section above.

[0108] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0109] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0110] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0111] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0112] Furthermore, the accompanying drawings are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It is readily understood that the processes shown in the above drawings do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0113] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0114] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for cross-domain authentication of self-identity, characterized in that, include: The user locally executes a trapdoor generation algorithm to generate the master public key matrix A and the corresponding short-base trapdoor T. A ; Based on the master public key matrix A and the user identity ID π Calculate the decentralized identity identifier (DID); Submit attribute verification materials to the certificate issuing authority and receive a random matrix returned by the certificate issuing authority for each attribute; The master public key matrix A is concatenated with each random matrix to form multiple attribute public key matrices; wherein, the j-th attribute public key matrix APK j =[A∣Q j ], Q j Let be the j-th random matrix, j = 1, 2, 3…n, where n is the total number of random matrices returned by the credential issuing authority; | is the concatenation function; all attribute public key matrices share the same trapdoor T. A This allows users to perform independent quantum-resistant signature operations on different attribute combinations in multiple authentication domains by maintaining only a single trapdoor, providing a cryptographic credential basis for cross-domain anonymous authentication.

2. The self-identity cross-domain authentication method as described in claim 1, characterized in that, The trapdoor generation algorithm is TrapGen(1 n Output the master public key matrix that satisfies the following conditions. and short base trap T A : A is statistically close to a uniform distribution; T A Let A be a short basis of A, used to generate samples that satisfy the presampling algorithm SamplePre. and private key sk π ,in ; Where q is the modulus of a large integer; For private key sk π The upper bound of H1 is the first preset hash algorithm, and the output result is a vector.

3. The self-identity cross-domain authentication method as described in claim 2, characterized in that, The decentralized identity identifier (DID) satisfies the following conditions: ； Where H is the second preset hash function, and the output result is a numerical value.

4. The self-identity cross-domain authentication method as described in claim 1, characterized in that, The attribute public key matrix APK j =[A∣Q j ] , where Q j The certificate is randomly generated by the certificate issuing authority after verifying that the user has the corresponding attributes and is securely transmitted to the user, without containing plaintext attribute values.

5. The self-identity cross-domain authentication method as described in claim 1, characterized in that, During cross-domain authentication, the user relies on the trapdoor T. A Given any attribute public key matrix and a public key list L consisting of attribute public key matrices of other users within the current authentication domain, execute a chainable ring signature algorithm based on the lattice cipher SIS hard problem to generate an anonymous credential containing chainable tags.

6. The self-identity cross-domain authentication method as described in claim 5, characterized in that, The linkable ring signature algorithm includes: Calculate linkable tags Where B is a preset linked tag matrix, ; If the user's actual index in the public key list L is π, for each index i ≠ π, execute: Short vectors are obtained through discrete Gaussian sampling. ;i∈{1,…,N}, where N is the total number of attribute public key matrices in L; Given a discrete Gaussian distribution The sampling space on the matrix has a standard deviation of σ, and m1+m2 is the number of columns in the attribute public key matrix; Calculate the intermediate value ID i Let be the user identifier corresponding to the i-th attribute public key matrix in L; Calculate the next challenge value ; For the actual index i=π, execute: (a) Obtaining short vectors through discrete Gaussian sampling ; (b) Calculate the challenge value ; (c) Constructing the response vector ; For the response vector z π Perform rejection sampling, retaining the result only if a preset probability condition is met, to ensure z π The statistical methods for obtaining short vectors using distributed and discrete Gaussian sampling are indistinguishable. Output anonymous credentials .

7. The self-identity cross-domain authentication method as described in claim 6, characterized in that, The verifier verifies the anonymous credential Ω based on public parameters and the public key list L, including: Verify all z i Is the norm less than a preset threshold? Verify the consistency of the hash chain and whether the closed-loop condition equation holds true; If all the above conditions are verified, the user is deemed to have the corresponding attribute permissions.

8. The self-identity cross-domain authentication method as described in claim 6, characterized in that, Anonymous credentials generated by the same user in different sessions have the same linkable tag to achieve cross-session linkability.

9. A non-transitory computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements a self-identity cross-domain authentication method as described in any one of claims 1 to 8.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a self-identity cross-domain authentication method as described in any one of claims 1 to 8.

Images